Add a security policy to your MCP server

What we checked

We looked in your source repository for a published security disclosure policy: a SECURITY.md that tells researchers how to report a vulnerability privately. The outcomes are:

Why it matters

When someone finds a vulnerability in your MCP server, the safest outcome is that they tell you first, privately, so you can ship a fix before it’s public. A SECURITY.md makes that the path of least resistance: it gives a clear private contact and sets expectations, instead of leaving a researcher to guess, or to disclose publicly out of frustration. It’s a small file that signals you take coordinated disclosure seriously, one of the package signals we score.

How to fix it

Add a SECURITY.md at the repository root, in the .github/ directory, or in docs/ (all three are recognised standard locations). This is the convention GitHub documents in its guide to adding a security policy: once the file is in place, GitHub surfaces a “Security policy” link in the repo’s Security tab and prompts anyone opening an issue to read it first. Keep it short and concrete: which versions you support, how to report privately, and how fast you’ll respond. Here’s a template you can adapt:

# Security Policy

## Supported versions

| Version | Supported |
| ------- | --------- |
| 2.x     | Yes       |
| 1.x     | Security fixes only |
| < 1.0   | No        |

## Reporting a vulnerability

Please report security issues privately. Do **not** open a public issue.

- Use GitHub's "Report a vulnerability" (Security > Advisories), or
- Email [email protected] with details and reproduction steps.

## What to expect

- We acknowledge reports within 3 business days.
- We aim to provide an initial assessment within 7 business days.
- We will keep you updated as we work on a fix, and credit you on
disclosure unless you prefer to remain anonymous.

Where does VerifyMCP look for the security policy?

We read GitHub’s community profile for your repository, which recognises a SECURITY.md in any of the three standard locations: the repository root, the .github/ directory, or docs/. Any one of them counts on its own, so you never need more than one; the file just has to sit on the default branch we resolve for the repo.

How we re-check

We re-scan the repository on our next crawl. Once a SECURITY.md is present at any of those three locations on the default branch, the signal flips to a pass on the following score refresh.

Give this to your AI

Paste this into Claude Code (or any coding agent) from inside your server's repository. It states the failing signal, the outcome we re-check for, and the format the fix has to take.

Context: this repository publishes an MCP server. VerifyMCP's security
policy check failed (or came back inconclusive because we could not even
read the repository), which means no `SECURITY.md` was found in a
recognised location, so researchers have no clear, private way to report
a vulnerability.

Goal: a `SECURITY.md` exists at the repository root, in `.github/`, or in
`docs/` on the default branch, so the next crawl records the policy as
present.

Do this:
1. Add a `SECURITY.md` at the repository root, in `.github/`, or in
   `docs/`; any one of the three locations counts on its own.
2. Include a supported-versions table, a genuinely private reporting
   channel (GitHub's private vulnerability reporting, or a dedicated
   security mailbox), and how quickly you aim to respond.
3. If you use a security email address, ask me which mailbox to publish;
   do not invent or guess a contact address.
4. Commit the file to the default branch we resolve for the repository.

Rules:
- Point reporters at a real private channel, not just the public issue
  tracker; a `SECURITY.md` that only links to public issues does not meet
  the intent of the check.
- Do not publish response-time commitments you have not confirmed with me;
  only include timelines I can actually stand behind.

Report back: the file path you added, which private channel you used, and
confirmation it is committed to the default branch.

Reference: https://verifymcp.io/docs/packages/security-policy